From d530ad5185f3fa66b323303ba953935180776ff9 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Thu, 1 Jul 2021 14:03:19 +0200
Subject: [PATCH 1/4] php74: 7.4.20 -> 7.4.21

fixes CVE-2021-21705 and CVE-2021-21704

(cherry picked from commit cf9fe3942e90eb6f97cfb69daa391b83f9868883)
---
 pkgs/development/interpreters/php/7.4.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/php/7.4.nix b/pkgs/development/interpreters/php/7.4.nix
index 79e736b30d5..e5c339e502d 100644
--- a/pkgs/development/interpreters/php/7.4.nix
+++ b/pkgs/development/interpreters/php/7.4.nix
@@ -4,8 +4,8 @@ let
   generic = (import ./generic.nix) _args;
 
   base = callPackage generic (_args // {
-    version = "7.4.20";
-    sha256 = "0d5ncz97y0271dsmz269wl4721vhq2fn6pmm9rxglc756p36pnha";
+    version = "7.4.21";
+    sha256 = "0al2697d5hwq0f39rgncl1pwfxzzpc0afmr0fjvw5qjpww163v1n";
   });
 
 in base.withExtensions ({ all, ... }: with all; ([

From ff22a4aecbbb4cea801ef513bd3620756775fe6b Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Thu, 1 Jul 2021 14:01:13 +0200
Subject: [PATCH 2/4] php80: 8.0.7 -> 8.0.8

fixes CVE-2021-21705 and CVE-2021-21704
also various other bugs, see https://www.php.net/ChangeLog-8.php#8.0.8
for a complete changelog

(cherry picked from commit d0c10fc34c575c83bc6716a42afe6044fc3730ea)
---
 pkgs/development/interpreters/php/8.0.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/php/8.0.nix b/pkgs/development/interpreters/php/8.0.nix
index 9d357f88afe..00cc1191961 100644
--- a/pkgs/development/interpreters/php/8.0.nix
+++ b/pkgs/development/interpreters/php/8.0.nix
@@ -4,8 +4,8 @@ let
   generic = (import ./generic.nix) _args;
 
   base = callPackage generic (_args // {
-    version = "8.0.7";
-    sha256 = "0yazcc9x66xg1gmi3rpgk891g6s3mm7aywcadqfqnx1mdz4z5ckj";
+    version = "8.0.8";
+    sha256 = "0vyi9hhy7yl4l589dniwb3gq29sp3giq7ni4nca3x54q3bbpgg8l";
   });
 
 in base.withExtensions ({ all, ... }: with all; ([

From beb567f715153581c2d48ce1d9e29d3151d04fc7 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Thu, 1 Jul 2021 20:56:50 +0200
Subject: [PATCH 3/4] php73: 7.3.28 -> 7.3.29

fixes CVE-2021-21705 and CVE-2021-21704

not cherry-picked from master, because that does not have php73 anymore
---
 pkgs/development/interpreters/php/7.3.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/development/interpreters/php/7.3.nix b/pkgs/development/interpreters/php/7.3.nix
index 569fb1b5405..773caa82760 100644
--- a/pkgs/development/interpreters/php/7.3.nix
+++ b/pkgs/development/interpreters/php/7.3.nix
@@ -4,8 +4,8 @@ let
   generic = (import ./generic.nix) _args;
 
   base = callPackage generic (_args // {
-    version = "7.3.28";
-    sha256 = "0r4r8famg3a8x6ch24y1370nsphkxg4k9zq5x8v88f4l8mj6wqwg";
+    version = "7.3.29";
+    sha256 = "1l74brhbkmmd0jbwyk5yixlapj3j4vlvysq4y0snkn0b2iw2hfm8";
 
     # https://bugs.php.net/bug.php?id=76826
     extraPatches = lib.optional stdenv.isDarwin ./php73-darwin-isfinite.patch;

From 0319a28db83c2bd0d4bf4a3e77a611c0dd5e9e62 Mon Sep 17 00:00:00 2001
From: ajs124 <git@ajs124.de>
Date: Thu, 1 Jul 2021 21:21:16 +0200
Subject: [PATCH 4/4] phpPackages.dom: make patch conditional

corresponds to 4c424870e62a5095896b48a12e9903835f6a5e53, but we still
need the patch for php73
---
 pkgs/top-level/php-packages.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkgs/top-level/php-packages.nix b/pkgs/top-level/php-packages.nix
index c59391ce290..0ecd4e9b56b 100644
--- a/pkgs/top-level/php-packages.nix
+++ b/pkgs/top-level/php-packages.nix
@@ -270,7 +270,7 @@ lib.makeScope pkgs.newScope (self: with self; {
       { name = "dba"; }
       { name = "dom";
         buildInputs = [ libxml2 ];
-        patches = [
+        patches = lib.optionals (lib.versionOlder php.version "7.4") [
           # https://github.com/php/php-src/pull/7030
           (fetchpatch {
             url = "https://github.com/php/php-src/commit/4cc261aa6afca2190b1b74de39c3caa462ec6f0b.patch";
@@ -280,7 +280,7 @@ lib.makeScope pkgs.newScope (self: with self; {
         ];
         # For some reason `patch` fails to remove these files correctly.
         # Since `postPatch` is already used in `mkExtension`, we have to make it here.
-        preCheck = ''
+        preCheck = lib.optionals (lib.versionOlder php.version "7.4") ''
           rm tests/bug43364.phpt
           rm tests/bug80268.phpt
         '';